Latest Updates on Kunai

Quentin Jerome presents an update on Kunai, a free and open-source Linux endpoint monitoring tool meant as a counterpart to Sysmon for Linux. It is aimed at incident responders and threat hunters who need better visibility into Linux hosts. Kunai records events such as binary executions, shared object loads, driver and file activity, and eBPF program loads. It keeps process ancestry so an investigator can follow how an event came about, and it is designed to work with container technologies.

The main new feature since the previous year's presentation is a filtering and detection layer. Rules are written in a simple YAML-based format and can either detect activity or filter logs. A rule can also trigger an action, currently either killing a process or scanning files with YARA rules. Other additions include loading indicators of compromise from a MISP server, scanning a system with YARA rules, and correlating host activity with network traffic using Community ID. A sandbox can run malware samples in a confined environment, and the observed behaviour can be turned into detection rules. The project also gained a service installation option, a hardened mode, and an ARM port for IoT devices.

The talk ended with an invitation to try the project and send feedback. The practical takeaway is that Kunai offers a free option for Linux endpoint visibility, detection and response work.